CEO Update

On 22 September 2022, a cyber-attack on Optus resulted in the disclosure of their customers’ personal information. Optus customer information including names, dates of birth, email addresses, driver’s licences, Medicare cards and passport numbers may have been exposed. The Australian Government has developed a factsheet about the Optus data breach, which provides advice for affected Optus customers and details government action of what is being done to protect the customers’ identities.

Although AML/CTF obligations do not apply to telecommunication service providers, the disclosure of customer personal information will heighten money laundering and crime risks in our business. You should remain vigilant to the impacts of the data breach when undertaking verification of a client’s identity. This includes:

• Be sure to view and certify original documents as part of your identification process
• Be aware that clients may have had their personal data compromised and so when interacting electronically, confirming you are dealing with your client is especially important
• Be aware or your responsibilities in reporting suspicious matters. These are:
  • Any time you suspect on reasonable grounds that a client is not the person they claim to be or have doubts about the veracity or adequacy of documents or information previously used for the purpose of identification, you must re-verify the client’s identity.
  • If you suspect a client or transaction may be relevant to the investigation of a crime, including reasonably suspecting they’re not who they claim to be or, they are a victim of a crime (including stolen or fraudulent documents), you must raise this concern with Professional Standards so that we can submit a suspicious matter report

If you have any questions or concerns regarding suspicious matters, what actions to take if you think identification may be compromised etc, please reach out to Professional Standards for assistance.

In early October AUSTRAC released guidance for financial advisers in relation to identifying source of funds and source of wealth. Below we have reproduced a series of questions to help guide you through the relevant aspects to be addressed when meeting these responsibilities.

Guiding questions to consider when developing your source of funds and source of wealth processes

• Can the customer’s or beneficial owner’s source of wealth or source of funds be easily explained, for example through their occupation, inheritance or investments?
• Is the customer’s (or their beneficial owner’s) background consistent with what you know about their former, current or planned business activity, their business’ turnover (if applicable), the source of funds and the customer’s (or beneficial owner’s) source of wealth?
• Have you been able to confirm that the information and documentation obtained as part of the source of funds/source of wealth checks make sense in light of all the information you know about the customer from your wider due diligence including open-source checks including your own website search verification?
• Do your high-risk customers require the same level of verification to establish source of funds/source of wealth?
• Do you determine a higher threshold for “reasonable measures” when a foreign PEP is the customer or the beneficial owner of the customer?

Why is ‘source of funds’ and ‘source of wealth’ important to know?
‘Source of funds’ refers to how and where the customer obtained the funds for a specific transaction or designated service you provide to the customer. Verifying, on a risk-sensitive basis, information collected about your customer’s source of funds will assist you in applying risk-based systems and controls in accordance with your AML/CTF program, and help you meet your transaction monitoring and suspicious matter reporting obligations. This process includes determining if you suspect on reasonable grounds that the customer’s funds could be derived from the proceeds of crime or may be relevant to the investigation of a criminal offence.

In collecting and verifying information on a risk-sensitive basis about a customer’s source of funds, you are aiming to answer, for example, the following questions:

• Is there a reasonable explanation for the customer to conduct this transaction?
• Are there any indicators that the customer’s source of funds are derived from the proceeds of crime?

‘Source of wealth’ refers to where the customer’s entire body of wealth and assets came from – not just what is involved in a transaction or business relationship. It describes the economic, business, or commercial activities that generated, or significantly contributed to, the customer’s overall net worth.

In collecting and verifying information on a risk-sensitive basis about a customer’s source of wealth, you are aiming to answer, for example, the following questions:

• Why and how does the customer have the amount of assets they do?
• How did they acquire or generate these assets?

A customer’s source of wealth may change over time and should be considered as part of your ongoing customer due diligence processes.

You can see a change in the issues being identified as the year has progressed. We have included the source of the requirement to give you an idea of its relevance. Please note that the civil penalties currently being identified as currently carved out for mandatory reporting.

Adviser scores allow us to risk adjust the results as follows:

Policy infringements      1
Legal infringements        2
Best Interest                    3 and civil penalties

To find out more about the recent Risk Profiling collateral refresh, see a video detailing all of the changes here. The new ‘Risk Profiling Workbook’, ‘Understanding Investment and Risk Guide for Clients’ and ‘Risk Profiling Presentation’ can be found in the Adviser Portal Risk Profiling folder. These should be the documents you now use with clients. If you have any questions, please email [email protected].

The FPW Investment Committee’s Review of Atrium’s Diversified Products is a comprehensive analysis of Atrium’s diversified product offerings and can be a useful tool from a ‘know your product’ perspective. The review can be found on the Adviser Portal in the Annual FPW Investment Committee Review of Atrium’s Product Suite and Investment Outcomes folder.

Following on from this year’s review, Atrium’s sector products will no longer have automatic approval on the APL (as an external research rating is generally required for inclusion on the APL). Therefore Special Approval will be required for new investments in the sector products of Atrium. Existing holdings will ‘grandfathered’ through a hold rating (Closed rating on the APL). Therefore, you will only have to apply for Special Approval for new investments into Atrium sector products such as the Australian Equities Portfolio on CFS or HUB24 or the MAPS Real Assets or MAPS Fixed Income Portfolios on HUB24. There is no change for MAPS Alternatives Portfolio which has required Special Approval in recent years. If you have any questions, please email [email protected].

Please click here for an update on the various fixes and enhancements that were applied in mid-October.

The focus of this webinar is the enhancements/fixes that were applied in mid-October and any FAQs in relation to the XPLAN Look & Feel Project. Opex will be demonstrating the changes/updates. Please click here to register for this update.

Several changes are happening over the next few weeks to enhance the security and functionality of our IT environment:

1. Upgrading of password requirements – the cyber security landscape is always changing and as you have seen in the news lately, more and more companies are experiencing data breaches, ransomware, or other cyber related incidents.

To improve our security posture, we are increasing the password requirements for Fitzpatricks IT users to a minimum of 12 characters (upper and lowercase). This is based on the advice of our external cyber experts ParaFlare and industry good practice (and illustrated very effectively by the image below). To assist users with this change, the recommendation is to use a passphrase that is easy to remember but hard to guess. Although this change is being applied to Fitzpatricks IT users, we strongly suggest that practices that manage their own IT environments implement this as well. We also encourage everyone to apply these principles to their personal passwords.

2. Changes to the MFA prompts – most of the breaches that occur are because of a compromised account where the bad actors get access using your credentials. Even with MFA active, bad actors have been able to use different techniques, including spamming you at 1 am with MFA requests, hoping you will just press Allow so you can go back to sleep. To provide further information to Fitzpatricks IT users regarding where these requests are coming from, we will be making changes to the MFA requests coming through the Authenticator app. This provides another good reason to move from an SMS message to the app.

3. Adopting Microsoft Teams Phone – the Brisbane and Sydney offices’ phone systems are moving from the current desk-based handsets to using Microsoft Teams Phone Calling in the next few weeks (timing subject to the porting of existing phone numbers). This will allow users in the Sydney and Brisbane offices to make and take PSTN landline and mobile phone calls via the Teams app on their desktop, mobile devices or tablet. This means that whether you are in the office, at home, or travelling, you will be able to operate your office number. This means no more redirecting your office phone number to your mobile.

We are moving the processing day to be Thursday the 24th of November as we will be out of the office on Friday the 25th of November for our annual Christmas event. By moving the processing day to the Thursday this gives us the opportunity to troubleshoot errors with tasks, follow up queries and avoid payments missing this payment run. Please load your tasks for this period as soon as possible with the due date set to the THURSDAY the 24th of November 2022. Any queries not finalised by the 24th of November, will be reviewed and processed on Monday the 28th of November 2022 – this should still make the same payment period run.

Please see below overview of upcoming webinars:

• Tuesday 15th November – XPLAN enhancements, fixes and FAQs
• Tuesday 1st December – Estate Planning

We are currently trialling automated reporting that is delivered to your inboxes to assist with managing your Service Agreements.

Emails will be sent to you and/or your practice support in the event that you have an upcoming Service Anniversary Date in the next 30 days.

This report will be sent to you at the start of each month.

Additional emails will be sent should there be a data issue identified and action is required.

For self help on identifying this information, a reminder that there is an abundance of guides available to you under the “Practice Fundamentals” page on the Adviser Portal.

• To understand which XPLAN report to run, we have a helpful guide focusing on Service Agreements and Fee Consent which can be found by clicking here.
• Further to the XPLAN reports, we have a guide to help you understand them.
  • A service case needs to be activated when services are offered to the client ensuring service items are met. For information on descriptions of service items can be found by clicking here.
  • Following an activated case, the benchmark (action item) needs to be completed within the case to demonstrate the service item has been met. To do this a file note need to be linked, so we have developed a guide to help which can be found by clicking here.

We are looking forward to seeing many of you at the conference in November. Make sure you have any special activities booked so you don’t miss out on an amazing experience.